The Intelligence EASY Button

In all of my years working in the intelligence field, I have never created my own acronym. Why? I don’t know. Maybe because I didn’t have anything impactful to say that could be boiled down to a nice and neat acronym. But today I received a bit of inspiration from the most random person… Jerry Seinfeld.

Jerry was kind enough today to spend some time on the Netflix campus and tell us a bit about his life and his craft. One of his stories involved a single joke that he had been working on for two years. This joke, for some reason, did not land, despite his many attempts. That is until one day, he decided to change a single word. That night, he performed it and it kills. This illustrates that mastery is not about being perfect, it is about using awareness and experience to make an impact or accomplish an objective.

After hearing Jerry story, I felt inspired and was thinking about my craft, threat intelligence, and my new mission, threat operations. I thought, “Wouldn’t it be great if I had a four point concept that covered the majority of my philosophy on intelligence?” Then I asked myself, “Wouldn’t it be even better when folks building their threat intelligence programs get stuck, they had a theoretical ‘button’ that they could press to get them back on track?”

Well, today is that day.

I have spent my career coaching intelligence analysts and teams and 85% of that material can be boiled to four simple, but at times difficult, concepts that could serve as a touchstone for intelligence leaders and practitioners. These concepts are:

• Elicit Requirements
• Assess Collection Plan
• Strive for Impact
• Yield to Feedback

And there you have it, the Intelligence EASY Button! These concepts are what I have always done and after a little inspiration from Jerry, I was able to distill my philosophy into digestible nuggets.

Let’s take some time to look at each of these.

For those of you who would rather watch a video than read, I have you covered!

Elicit Requirements

“It’s not me, it’s you” -Lily Allen

If you have been following me for a while or watch my podcast, feel free to just skip right over to Assess Collection Plan. I have foot-stomped this concept so many times. Threat intelligence teams, companies, experts are in the “service” business. We support other functions. While I do believe we lead security (that is an article on its own), our work is not about us, it is about our stakeholders. We need to know what information they require that will make their jobs more efficient, more effective, or change what they are doing entirely. You will encounter some stakeholders that do not know what information will aid those objectives. These are one of my favorite situations. You can have an “aha” moment right there with your stakeholder. Ask questions. Ask good questions. Practice asking questions and refine your stakeholder analysis. You will find, the more polished the requirements, the easier it is to support your stakeholders.

Assess Collection Plan

“Everybody has plans, until they get hit.” -Mike Tyson

If you are starting a threat intelligence program and you have a fleshed out collection plan before you did your first stakeholder interview, I assess with HIGH confidence you will have to go back to the drawing board. Even after you have done stakeholder analysis and there are new requirements that come up, you will have to look at what information you are currently using for your analysis. Ask yourself, “Is this feed answering the questions my stakeholders have?” Every feed is not for every team. A great source may not have the answers you are looking for. Constantly re-assess your collection plan and be aggressive in trimming away the non-essential.

Strive for Impact

“What you do has far greater impact than what you say.” -Stephen Covey

Let me paint a picture. You have spent the last two months working on a report you believe will change the game at your company. You were diligent in your analysis. You included the best research from world-renowned experts. You polished it up real nice with the help of a couple editors. You even had marketing take a stab at making graphics for you. You deliver your masterpiece and… crickets. You wait a few days and ask, “Hey, what was the reception of the report?” Your boss replies, “It was great work! Everyone loved it. The only problem is they didn’t understand the ‘So what?’” Ouch… I have been there and I am sure many of you have been there too. The beauty of threat intelligence or intelligence in general is it has the ability to incite change. The work I do can literally change the way my company operates, if I strive for impact in my intelligence analysis and reporting. Take some time and think about what information is going to who, in what context, and to support what decision, every time you hit send on that email.

Yield to Feedback

“Feedback is the breakfast of champions.” -Ken Blanchard

Before I even begin talking about using feedback, I feel obligated to provide a tip about receiving feedback. Please, make it easy for your stakeholder to present feedback. For instance, I built a simple Google form that I can send pre-filled with context data to the stakeholder that can be filled in under a minute, if they so wish. Subsequently, I produce a shareable link and personally message the stakeholder. I thank them for submitting the request for information and ask them to fill out the form. I also mention it will take only moments of their time. It is not my intent to boast, but under this construct I have a 100% return on my request for feedback. Now once you have your feedback, use it! Even if you believe your stakeholder is misaligned in some way, that still means the mark is being missed. Are your reports too long? Are they missing key details? Was your intelligence not actionable? Was the delivery medium wrong? Did it take too long? These are just a few examples of things that, while they bruise the ego, can incrementally improve your intelligence reports and, ultimately, your intelligence program.

So there you have it, folks. The Intelligence EASY button. This is what I use for my work and I hope it helps others. Feel free to send this to people you think would benefit from having a touchstone like this. I will be doing deep-dive articles on each of the concepts in this methodology in the coming weeks. Let me know if this resonates with you or you completely disagree. I would love to hear your thoughts, questions, and feedback. ;)

As always, thanks for reading,

Chris

Want to stay in touch or see other content I produce? Check me out on LinkedIn: www.linkedin.com/in/chriscochrancyber